# Bug: Invite rate limit applied silently, undocumented **URL:** \ **Category:** Troubleshooting\ **Created:** [July 30, 2020, 11:21pm UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211 "2020-07-30T23:21:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mpounsett](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/mpounsett/32/4056_2.png) [@mpounsett](https://forum.mattermost.com/u/mpounsett)\ **Post date:** [July 30, 2020, 11:21pm UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211/1 "2020-07-30T23:21:14Z")
#### Summary API invites by email are silently rate-limited, and rate limits are undocumented. #### Steps to reproduce Using 5.25.1, attempt to call the `Invite users to the team by email` API call with a list of more than 20 email addresses. `http://your-mattermost-url.com/api/v4/teams/{team_id}/invite/email` #### Expected behavior If rate limiting is applied, the API call should fail. Rate limiting should be documented in the API reference. I would expect an HTTP response code in the 400 range. Possibly 413 (request entity too large) with a `retry-after` header indicating when the next batch could be accepted. #### Observed behavior The API returned a 200 result code, and mattermost wrote the following to its log: `{"level":"error","ts":1596150191.2522833,"caller":"mlog/log.go:175","msg":"Invite emails rate limited.","user_id":"gst7u7g9zbdsbmiesiwkjnuqcw","team_id":"pieu7ohjkibntm6jko86jxrgao","retry_after":"-1ns"}` The only reference I can find to this rate limit is in this [other forum post](https://forum.mattermost.com/t/invite-emails-rate-limited/7404). I can’t find it in the general documentation, and it is definitely not documented in the API reference. It seems to me that the API call should be updated to include a result code that indicates the list of addresses is too large (e.g. 413). The parameters of the rate limit should also be documented (how many email addresses are allowed … how long one must wait before sending more … etc). If the rate limit could be made configurable that would also be useful. In the mean time, can someone clarify for me exactly what limits are placed on this call? Thanks! ---
**Author:** ![amy.blais](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/amy.blais/32/7481_2.png) [@amy.blais](https://forum.mattermost.com/u/amy.blais)\ **Post date:** [July 31, 2020, 1:09pm UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211/2 "2020-07-31T13:09:40Z")
Could these docs help: [https://docs.mattermost.com/administration/config-settings.html#rate-limiting](https://docs.mattermost.com/administration/config-settings.html#rate-limiting)? ---
**Author:** ![mpounsett](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/mpounsett/32/4056_2.png) [@mpounsett](https://forum.mattermost.com/u/mpounsett)\ **Post date:** [July 31, 2020, 2:15pm UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211/3 "2020-07-31T14:15:55Z")
The person in the other posting asked about that, and you said that no, those rate limits are not the same thing. Reading the docs suggests to me that is the rate limiting for API calls in general. What I’m encountering here is a rate limit on email address invites per hour. Also, those docs don’t address the problem of the rate limiting being applied silently. ---
**Author:** ![mpounsett](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/mpounsett/32/4056_2.png) [@mpounsett](https://forum.mattermost.com/u/mpounsett)\ **Post date:** [July 31, 2020, 2:25pm UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211/4 "2020-07-31T14:25:05Z")
Also, after some more thought, it occurs to me that my Expected Behaviour section above is too simple. There are really two similar-but-different error conditions here: 1. more than the maximum number of addresses were sent in the json blob (e.g. the list is 21 addresses) 2. more than the maximum number of addresses per hour are trying to be sent (e.g. 10 have already been sent this hour, and now a request is received with 11 addresses) Probably both should be a `413 Entity Too Large` response code, but the first would not have a `retry-after` header and the second would. I’d suggest there should also be different text in the `message` field of the response json. ---
**Author:** ![ahmaddanial](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/ahmaddanial/32/2938_2.png) [@ahmaddanial](https://forum.mattermost.com/u/ahmaddanial)\ **Post date:** [August 5, 2020, 1:40am UTC](https://forum.mattermost.com/t/bug-invite-rate-limit-applied-silently-undocumented/10211/5 "2020-08-05T01:40:31Z")
Hi, everyone. For reference purposes, I went ahead and created this bug report: - [Undocumented Silent API Invite Rate Limit](https://mattermost.atlassian.net/browse/MM-27507) Feel free to share and add more comments related to the issue in the official ticket. Thanks.